Windows 7 StickyNotes follow the [http://msdn.microsoft.com/en-us/library/dd942138%28v=prot.13%29.aspx MS Compound Document binary format]; the StickyNotes Parser extracts metadata (time stamps) from the OLE format, including the text content (not the RTF contents) of the notes themselves. Sn.exe also extracts the modified time of the Root Entry to the Compound Document; all times are displayed in UTC format

+

:http://code.google.com/p/winforensicaanalysis/downloads/list

=PDF Files=

=PDF Files=

Line 37:

Line 42:

=Images=

=Images=

+

+

; [[Exiftool]]

+

: http://www.sno.phy.queensu.ca/~phil/exiftool/

+

: Free, cross-platform tool to extract metadata from many different file formats. Also supports writing

StickyNotes

StickyNotes Parser

Windows 7 StickyNotes follow the MS Compound Document binary format; the StickyNotes Parser extracts metadata (time stamps) from the OLE format, including the text content (not the RTF contents) of the notes themselves. Sn.exe also extracts the modified time of the Root Entry to the Compound Document; all times are displayed in UTC format

"Developed by the National Library of New Zealand to programmatically extract preservation metadata from a range of file formats like PDF documents, image files, sound files Microsoft office documents, and many others."